Unobtrusive protection for large-scale data breaches utilizing user-specific data object access budgets

Patent metadata

Field	Value
Publication number	US-9674201-B1
Application number	US-201514983423-A
Country	US
Kind code	B1
Filing date	Dec 29, 2015
Priority date	Dec 29, 2015
Publication date	Jun 6, 2017
Grant date	Jun 6, 2017

Abstract

Techniques for unobtrusively protecting against large-scale data breaches over time are described. A security gateway coupled between clients and servers receives data object (DO) access requests from the clients on behalf of users of an enterprise. Each of the users is allocated a budget for each of one or more time periods. The security gateway determines an access cost for each DO access request based on characteristics of the DO request, where lower access costs are indicative expected DO access consumption for users of the enterprise, and charges the determined access cost against the budget for that user corresponding to the time period when the DO access request was received. Alert messages are transmitted based on different ones of the users exceeding their budget(s), and the transmission of the DO access requests to the data object servers is not prevented.

First claim

What is claimed is:

1. A method in a security gateway for unobtrusively protecting against large-scale data breaches over time, wherein the security gateway is communicatively coupled between a plurality of client end stations and one or more servers that store and serve a plurality of files, the method comprising:
receiving, at the security gateway from one or more of the plurality of client end stations during one or more time periods, a plurality of file access requests sent on behalf of a plurality of users belonging to an enterprise, wherein the plurality of file access requests seek access to one or more of the plurality of files stored by the one or more servers, wherein each of the plurality of file access requests includes an immutable identifier of one of the files, wherein each of the plurality of users is allocated a budget for each of the one or more time periods;
for each file access request of the plurality of file access requests, performing the following:
determining an access cost for the file access request based on characteristics of the file access request, wherein lower access costs are indicative of file access requests that are part of expected file access consumption for the plurality of users belonging to the enterprise, and
charging the determined access cost against the budget for that user corresponding to the one of the one or more time periods when the file access request was received; and

transmitting alert messages, but not preventing either a transmission of the plurality of file access requests to the one or more servers or further but different security-related analysis of the plurality of file access requests by the security gateway, based on different ones of the plurality of users exceeding their respective budgets.

2. The method of claim 1 , wherein the access costs determined for two different ones of the plurality of file access requests that seek access to a same one of the plurality of files and that were sent on behalf of a same one of the plurality of users are different.

3. The method of claim 1 , wherein the access costs determined for two different ones of the plurality of file access requests that seek access to a same one of the plurality of files and that were sent on behalf of two different ones of the plurality of users are different.

4. The method of claim 1 , wherein at least one of the determined access costs is zero.

5. The method of claim 1 , wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is which of the plurality of users on whose behalf that file access request was sent.

6. The method of claim 5 , wherein another of the characteristics of that file access request that the determined access cost is based upon is an identity of a creator or owner of the requested file.

7. The method of claim 1 , wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is a time the file access request was received at the security gateway.

8. The method of claim 1 , wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is an identifier of the client end station that transmitted that file access request.

9. The method of claim 1 , wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is some or all of a relative or absolute path of the requested file.

10. The method of claim 1 , wherein at least one of the alert messages is transmitted to either:
a manager of the user having the exceeded budget; or
a security administrator of the enterprise.

11. The method of claim 1 , wherein at least one of the alert messages is transmitted responsive to an end of one of the one or more time periods as opposed to being transmitted at the exceeding of one of the budgets.

12. The method of claim 1 , wherein:
at least two of the alert messages are transmitted responsive to a budget of a user of a time period being exceeded;
a first of the at least two alert messages is sent after receipt of one of the file access requests causing the budget to be exceeded; and
a second of the at least two alert messages is sent at an end of the time period.

13. The method of claim 1 , wherein at least one of the alert messages is sent responsive to one of the plurality of users exceeding their respective budget for multiple time periods.

14. The method of claim 1 , further comprising performing, by the security gateway, additional logging for future file access requests sent on behalf of one or more of the plurality of users that exceed their respective budgets.

15. The method of claim 1 , wherein the one or more time periods includes at least two time periods that at least partially overlap.

16. The method of claim 15 , wherein the one or more time periods include a first time period and a second time period, wherein the first time period is larger than the second time period and overlaps all of the second time period, wherein each of the plurality of users is allocated a first budget for the first time period and a second budget for the second time period, and wherein the first budget is different than the second budget.

17. The method of claim 16 , wherein one of the alert messages is transmitted responsive to, for one of the plurality of users, the first budget being exceeded despite the second budget not being exceeded.

18. A security gateway comprising:
one or more processors; and
a non-transitory computer readable medium storing instructions which, when executed by the one or more processors, cause the security gateway to perform operations for unobtrusively protecting against large-scale data breaches over time, wherein the security gateway is to be communicatively coupled between a plurality of client end stations and one or more servers that store and serve a plurality of files, the operations comprising:
receiving, from one or more of the plurality of client end stations during one or more time periods, a plurality of file access requests sent on behalf of a plurality of users belonging to an enterprise, wherein the plurality of file access requests seek access to one or more of the plurality of files stored by the one or more servers, wherein each of the plurality of file access requests includes an immutable identifier of one of the files, wherein each of the plurality of users is allocated a budget for each of the one or more time periods;
for each file access request of the plurality of file access requests, performing the following:
determining an access cost for the file access request based on characteristics of the file access request, wherein lower access costs are indicative of file access requests that are part of expected file access consumption for the plurality of users belonging to the enterprise, and
charging the determined access cost against the budget for that user corresponding to the one of the one or more time periods when the file access request was received; and

transmitting alert messages, but not preventing either a transmission of the plurality of file access requests to the one or more servers or further but different security-related analysis of the plurality of file access requests by the security gateway, based on different ones of the plurality of users exceeding their respective budgets.

Assignees

• Imperva Inc

Inventors

• Margel Shiri
• Mantin Itsik
• Shulman Amichai

Classifications

• H04L63/102 Primary

  Entity profiles · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title